Geoffrey White
dd95131630
C++: Test spacing.
2021-10-08 14:28:42 +01:00
Rasmus Lerchedahl Petersen
4807f50c00
Merge branch 'main' of github.com:github/codeql into python-dataflow/init-time
2021-10-08 14:55:01 +02:00
ihsinme
8c42545d1c
Update FindWrapperFunctions.qhelp
2021-10-08 13:10:36 +03:00
Rasmus Wriedt Larsen
fd0c386a4c
Python: Add change-note
2021-10-08 12:06:18 +02:00
Rasmus Wriedt Larsen
5e6f042f6e
Python: Model pickle.Unpickler
2021-10-08 11:55:54 +02:00
Rasmus Wriedt Larsen
75b06d8a25
Python: Model dill.load
2021-10-08 11:55:54 +02:00
Rasmus Wriedt Larsen
4820be3b10
Python: Model keyword arguments to dill.loads
2021-10-08 11:55:54 +02:00
Rasmus Wriedt Larsen
9180257afe
Python: Refactor Dill.qll
...
So it matches the layout of all our other qll modules modeling a PyPI
package.
2021-10-08 11:55:54 +02:00
Rasmus Wriedt Larsen
f9333fc551
Python: Expand dill tests
2021-10-08 11:55:54 +02:00
Rasmus Wriedt Larsen
42980a1ab4
Python: Model shelve.open
2021-10-08 11:55:54 +02:00
Tony Torralba
2df30dc107
Use InlineFlowTest for local and remote flow tests
2021-10-08 11:48:35 +02:00
Anders Schack-Mulligen
446c738f20
Merge pull request #6790 from aschackmull/dataflow/force-precision
...
Dataflow: Force high precision of certain Contents.
2021-10-08 11:44:26 +02:00
Calum Grant
958fbc7992
Merge pull request #316 from github/calumgrant/readme
...
Update README.md
2021-10-08 10:36:07 +01:00
Alex Ford
9dedb0540e
Merge pull request #312 from github/rb/stored-xss-1
...
Implement `rb/stored-xss` query
2021-10-08 10:33:11 +01:00
ihsinme
d79596354e
Update cpp/ql/src/experimental/Security/CWE/CWE-1041/FindWrapperFunctions.ql
...
Co-authored-by: Mathias Vorreiter Pedersen <mathiasvp@github.com >
2021-10-08 11:50:45 +03:00
Tom Hvitved
951df380a9
Merge pull request #6829 from hvitved/csharp/gvn-to-string-concat-range
...
C#: Speedup GVN string `concat`s by pulling ranges into separate predicates
2021-10-08 10:02:31 +02:00
Anders Schack-Mulligen
06e59f3b17
Merge pull request #6832 from github/workflow/coverage/update
...
Update CSV framework coverage reports
2021-10-08 09:53:49 +02:00
Anders Schack-Mulligen
1bec58dee5
Dataflow: Fix more qldoc: s/accesspath/access path/.
2021-10-08 09:41:26 +02:00
github-actions[bot]
062250741a
Add changed framework coverage reports
2021-10-08 00:08:55 +00:00
Rasmus Wriedt Larsen
a81d359669
Python: Model marshal.load
2021-10-07 21:27:51 +02:00
Rasmus Wriedt Larsen
1b61296ea5
Python: Model pickle.load
2021-10-07 21:25:48 +02:00
Rasmus Wriedt Larsen
27c368a444
Python: Model keyword arguments to pickle.loads
2021-10-07 21:24:12 +02:00
Rasmus Wriedt Larsen
3592b09d56
Python: Expand stdlib decoding tests
...
The part about claiming there is decoding of the input to `shelve.open`
is sort of an odd one, since it's not the filename, but the contents of
the file that is decoded.
However, trying to only handle this problem through path injection is
not enough -- if a user is able to upload and access files through
`shelve.open` in a path injection safe manner, that still leads to code
execution.
So right now the best way we have of modeling this is to treat the
filename argument as being deserialized...
2021-10-07 21:11:51 +02:00
Alex Ford
16ab4da812
Update ql/lib/codeql/ruby/security/XSS.qll
...
Co-authored-by: Harry Maclean <hmac@github.com >
2021-10-07 20:03:07 +01:00
Rasmus Wriedt Larsen
a31bf75169
Python: Refactor pickle.loads() modeling
2021-10-07 20:28:30 +02:00
Robert Marsh
2539e3247a
Merge pull request #6814 from MathiasVP/fix-qldoc-in-copy-instruction
...
C++/C#: Fix QLDoc of `CopyInstruction`
2021-10-07 11:18:38 -07:00
Aditya Sharad
2ed572095c
CLI docs: Address comments on Bazel example
2021-10-07 10:51:11 -07:00
yoff
933412eb8d
Apply suggestions from code review
...
Co-authored-by: Taus <tausbn@github.com >
2021-10-07 17:45:07 +02:00
Nick Rolfe
eafe22ef93
Merge remote-tracking branch 'origin/main' into nickrolfe/oj
2021-10-07 16:40:36 +01:00
Tony Torralba
91efb61e97
Use synthetic fields to improve taint precision
2021-10-07 17:03:08 +02:00
Tony Torralba
0325c07bd9
Reorganize fluent models
2021-10-07 17:03:07 +02:00
Tony Torralba
ffa77f0a76
Fix QLDoc
2021-10-07 17:03:07 +02:00
Tony Torralba
588dedc265
Add stubs
2021-10-07 17:03:05 +02:00
Tony Torralba
1a04ad98bc
Add Android Slice models
2021-10-07 17:01:16 +02:00
Arthur Baars
2a32b59840
Merge pull request #331 from github/aibaars/remove-unsafe
...
Remove use of 'unsafe'
2021-10-07 16:58:59 +02:00
Alex Ford
de01770612
update test output
2021-10-07 15:50:35 +01:00
Arthur Baars
439d873564
Remove use of 'unsafe'
2021-10-07 16:38:29 +02:00
Alex Ford
168e67dd6d
deduplicate string constantQualifiedName(ConstantWriteAccess) as string ConstantWriteAccess#getQualifiedName
2021-10-07 15:30:36 +01:00
Alex Ford
5b38e06765
Rename ActiveRecordModelClass#methodMayAccessField() as ActiveRecordModelClass#getAPotentialFieldAccessMethod()
2021-10-07 15:30:36 +01:00
Alex Ford
3bdc680434
Drop a comment that is no longer relevant
2021-10-07 15:30:36 +01:00
Alex Ford
8262247ed7
Minor simplification of finderMethodName predicate
2021-10-07 15:30:36 +01:00
Alex Ford
eb8c48d10f
Remove some unused predicates
2021-10-07 15:30:36 +01:00
Alex Ford
c9edbd98d5
Update ql/lib/codeql/ruby/frameworks/ActiveRecord.qll
...
Co-authored-by: Harry Maclean <hmac@github.com >
2021-10-07 15:30:36 +01:00
Alex Ford
e4fe1d5c13
check for superclass method definitions in ActiveRecordModelClass#methodMayAccessField
2021-10-07 15:30:36 +01:00
Alex Ford
fb5cfcc9b0
OrmTracking goes through or expressions
2021-10-07 15:30:36 +01:00
Alex Ford
be018cc97f
update ActionController tests
2021-10-07 15:30:36 +01:00
Alex Ford
955080234b
partial support for rails layouts
2021-10-07 15:30:36 +01:00
Alex Ford
8e1b48e607
StoredXSS.qhelp
2021-10-07 15:30:36 +01:00
Alex Ford
182a926eeb
rename some example files
2021-10-07 15:30:36 +01:00
Alex Ford
1929a95e89
format
2021-10-07 15:30:36 +01:00
